CVE-2026-80128: Dell Secure Connect Gateway Auth Bypass

CVE-2026-80128 Overview

CVE-2026-80128 is an improper authentication vulnerability [CWE-287] in Dell Secure Connect Gateway (SCG) 5.0. The flaw affects Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. A low-privileged attacker with remote network access can exploit the flaw to bypass a protection mechanism, compromising integrity of the affected component. Dell published corrective guidance in advisory DSA-2026-382.

Critical Impact
An authenticated remote attacker with low privileges can bypass authentication controls in Dell SCG, enabling unauthorized modification of protected resources without requiring user interaction.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell SCG Virtual Edition (as referenced in DSA-2026-382)

Discovery Timeline

2026-09-07 - CVE-2026-80128 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80128

Vulnerability Analysis

Dell Secure Connect Gateway provides a secure telemetry and remote-support channel between Dell infrastructure and Dell backend services. CVE-2026-80128 stems from improper authentication logic within the SCG 5.0 code base. The affected component does not fully validate the identity or privilege context of the requester before performing a security-relevant action. As a result, a caller who already holds low-privileged remote access can trigger operations that should require stronger authentication.

The issue is categorized under [CWE-287: Improper Authentication]. The confidentiality impact is rated none, but the integrity impact is high, indicating that successful exploitation lets an attacker alter protected data or state. Availability is not affected. No public proof-of-concept, exploit code, or in-the-wild activity is reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is a protection-mechanism bypass in the authentication path of Dell SCG 5.0. The service accepts requests from an authenticated but low-privileged principal and fails to enforce the expected authentication check on a protected function. Dell has not published the specific handler or endpoint at fault, but the vendor advisory confirms the defect and ships a fixed build.

Attack Vector

Exploitation requires network reachability to the SCG management interface and a valid low-privileged account. No user interaction is required. An attacker uses their existing session to invoke a protected operation that should be reserved for higher-privileged roles, achieving a protection-mechanism bypass with integrity impact.

No verified exploitation code is available for this CVE. Refer to the Dell Security Advisory DSA-2026-382 for vendor-supplied technical detail.

Detection Methods for CVE-2026-80128

Indicators of Compromise

Successful authentication events from low-privileged SCG accounts followed by administrative or configuration-changing API calls
Unexpected changes to SCG configuration, connectivity settings, or telemetry policies without a corresponding change-management record
Repeated requests to SCG management endpoints from a single low-privileged principal within a short time window

Detection Strategies

Compare the running SCG Appliance version against 5.36.00.16 and SCG Application version against 5.36.00.00; anything lower is vulnerable
Baseline the expected set of API operations performed by each SCG role and alert when a low-privileged role invokes operations normally scoped to administrators
Correlate SCG audit logs with network flow data to identify remote sources reaching the management plane from outside expected administrative subnets

Monitoring Recommendations

Forward SCG application and appliance audit logs to a centralized SIEM for continuous review
Monitor for privilege-tier changes, credential additions, and integration modifications on SCG systems
Alert on outbound connections initiated by SCG that do not match the documented Dell backend destinations

How to Mitigate CVE-2026-80128

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later, and Dell SCG 5.0 Application to version 5.36.00.00 or later
Restrict network access to the SCG management interface to a dedicated administrative network segment
Review and reduce the number of low-privileged accounts with remote access to the SCG, and rotate credentials for any account that no longer requires access

Patch Information

Dell released fixed builds through advisory DSA-2026-382: Security Update for Dell Secure Connect Gateway Virtual Edition. Administrators should apply the fixed appliance image 5.36.00.16 or the fixed application build 5.36.00.00 as documented by Dell. Follow the vendor's upgrade path guidance to preserve integration with Dell backend services.

Workarounds

Isolate SCG management interfaces behind a firewall or jump host that enforces multi-factor authentication
Disable or suspend any low-privileged SCG accounts that are not actively required until the patched version is deployed
Enable verbose audit logging on SCG and forward events to a SIEM to shorten detection time if the patch cannot be applied immediately

bash

# Configuration example: verify installed SCG version before and after upgrade
# On the SCG appliance CLI
scg --version

# Expected output after remediation (or later):
# Appliance: 5.36.00.16
# Application: 5.36.00.00